Privacy Policy
Short, because there isn't much to say. This site sets no cookies, runs no analytics, and collects nothing about you as you read it.
Last updated 28 August 2026
Who is responsible
Paolo Bonavera, based in Amsterdam, the Netherlands, is the controller for the personal data described here. You can reach me at me@paolobonavera.com.
What this website collects
Nothing that identifies you. There is no analytics platform on this site, no tracking pixels, no advertising tags, and no cookies — which is also why you aren't being asked to consent to any. There is no contact form either: nothing on these pages submits anything anywhere. The pages are static files; reading them tells me nothing about who you are.
Hosting and request data
These pages are static files served by Cloudflare Pages. Cloudflare is a processor acting on my behalf, and it is the one third party involved in getting this site to you.
Cloudflare runs a global network and answers each request from whichever location is nearest the visitor, so a request may be handled outside the EEA. Those transfers are covered by Cloudflare's data processing terms and the safeguards set out in them.
Like any web server, that edge records request metadata — IP address, timestamp, the page requested, and browser user-agent — in order to serve the site and defend it against abuse. That is my legitimate interest under Article 6(1)(f) GDPR. I don't run an access log of my own, I don't use that data to build a profile of visitors, and I don't combine it with anything else. Cloudflare holds it under its own retention policy, set out in its privacy policy.
If you contact me
If you email me, I have your email address and whatever you chose to put in the message. I use it to reply to you and, if we end up working together, to run the engagement. I keep correspondence for as long as it's commercially relevant, and business records for as long as Dutch tax law requires.
If you book a call, that booking is handled by Google on its own infrastructure and under its own privacy policy — so the name, email address and any note you enter on the booking page go to Google as well as to me, and may be processed outside the EEA under that provider's own safeguards. Booking a call is entirely optional; emailing me instead involves no third party beyond my mail provider.
What I don't do
- No advertising or profiling, and no data sold or shared for marketing.
- No newsletter you were signed up for without asking.
- No automated decision-making about you.
Your rights
Under the GDPR you can ask me for a copy of the personal data I hold about you, ask me to correct it, ask me to delete it, or object to my processing it. Email me and I'll handle it — there's no process to navigate. If you think I've got it wrong, you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens.
Changes
If this site starts doing something that collects more than it does today, this page changes first and the date at the top changes with it.